Skip to content

I'm Your MAC(b)Daddy

Grayson Lenik

Grayson Lenik - I'm Your MAC(b)Daddy The field of Computer Forensics moves more and more in the direction of rapid response and live system analysis every day.

Summary

Architecture and Background

Grayson Lenik - I'm Your MAC(b)Daddy The field of Computer Forensics moves more and more in the direction of rapid response and live system analysis every day. As breaches and attacks become more and more sophisticated the responders need to continually re-examine their arsenal for new tactics and faster ways to process large amounts of data.

Vulnerability Analysis

Timelines and super-timelines have been around for a number of years but new software and techniques brings them back into play for Incident Response and live analysis instead of static postmortem forensics. Add in identification of anti-forensics techniques and you gain a whole new view on forensic timelines.

Exploitation and Demonstrations

Grayson Lenik is a Security Consultant at Trustwave and a member of Trustwave's SpiderLabs - the advanced security team focused on penetration testing, incident response, and application security. He has over 12 years of System Administration experience including 6 years with American Express/IBM Global Services at one of the largest data centers in the world.

Remediation and Defensive Strategies

Prior to his career in IT he was an Aviation Electronics Technician in the United States Navy forward deployed on board the USS Kitty Hawk and USS Independence. Grayson is a Microsoft Certified Systems Engineer (MCSE), a GIAC Certified Forensic Analyst (GCFA) and a Qualified Security Assessor (QSA). He is working towards the CISSP certification and a Bachelor's in Information Security. Grayson authors the computer forensics blog "An Eye on Forensics". Twitter:@handlefree

Related talks

Main Stage·43 min

  • DEF CON
  • Blue Team
  • Date: Aug 2013
  • Location: Las Vegas

Gregory Pickett

Gregory Pickett details let's screw with nmap GREGORY PICKETT PENETRATION TESTER, HELLFIRE SECURITY Differences in packet headers allow tools like nmap to fingerprint operating systems.

blue-teamthreat-detectionincident-response+1